CVE-2025-40035
Description
An information disclosure flaw was found in the Linux kernel's uinput driver in the force feedback upload handling for 32-bit compatibility mode. A local user can trigger this issue by performing force feedback upload operations through the uinput device, where uninitialized padding bytes in the uinput_ff_upload_compat structure are copied to userspace. This leaks kernel stack memory contents to unprivileged users.
Statement
The uinput driver provides a userspace interface for creating virtual input devices with force feedback support. When handling FF_UPLOAD requests in 32-bit compatibility mode, the driver constructs a uinput_ff_upload_compat structure on the stack. This structure embeds ff_effect_compat twice, which contains internal padding bytes for alignment (notably after struct ff_replay before a union member). The code populates the valid fields but leaves padding uninitialized. When copy_to_user() transfers the entire structure, these padding bytes expose whatever stack data happened to occupy that memory. While the leaked data is limited in size and content is unpredictable, it could potentially reveal kernel pointers or other sensitive information useful for defeating KASLR or further exploitation.
Mitigation
To mitigate this issue, prevent the uinput module from being loaded if virtual input devices are not required. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
